fix(windows): hide console flash on backend git/gh/pdftoppm spawns the sweep missed

[OutThisLife]

Summary

Three backend spawn legs that run inside the console-less desktop/gateway backend still flash a fresh console window on Windows. The recent backend sweep (#54236 "hide console-window flash on backend git/gh/wmic/bash subprocess spawns", #54417 "cover remaining console-flash spawn legs") routed git_probe, the repo-file picker, coding_context, context_references, copilot_auth, and the gateway process scans through CREATE_NO_WINDOW — but missed these sibling sites:

• tools/checkpoint_manager.py — _run_git (and the one-shot git init --bare in _init_store). When checkpoints are enabled, every file-mutating turn fires several bare git calls (status, add, write-tree/commit-tree, update-ref). The desktop spawns the backend with windowsHide (→ CREATE_NO_WINDOW), so the backend has no console, and each child git.exe allocates its own conhost → a flurry of terminal popups.
• tools/skills_hub.py — GitHubAuth._try_gh_cli (gh auth token). Same bug class as the already-fixed copilot_auth gh probe; this is the sibling call path.
• tui_gateway/server.py — the PDF-attach handler shells out to pdftoppm; one conhost flash per attach on Windows.

All route through windows_hide_flags() (no-op on POSIX), matching the established per-site form (creationflags=windows_hide_flags(), exactly how server.py::_list_repo_files already does it). This is the targeted-per-site approach the maintainers settled on after rolling back the global chokepoint in #53853 — not a resurrection of that approach.

Why these were missed

They're not in the tui_gateway/gateway/hermes_cli cluster the sweep focused on — they live under tools/ (and one server.py media handler) and only fire under specific feature flags (checkpoints on) or actions (installing a GitHub skill, attaching a PDF), so they didn't surface in the project-load reproduction.

Commits

1. fix(windows) — checkpoint git + skills_hub gh probes (+ tests)
2. fix(windows) — pdftoppm console flash on PDF attach
3. refactor(windows) — unify all touched sites on creationflags=windows_hide_flags(); drop the IS_WINDOWS import + ternary/one-use-dict gating (no-op on POSIX anyway)

Test plan

• scripts/run_tests.sh tests/test_windows_subprocess_no_window_flags.py -q — 15 pass (2 new: checkpoint git, skills_hub gh)
• scripts/run_tests.sh tests/tools/test_checkpoint_manager.py -q — 77 pass
• import smoke + ast.parse on all edited files

[github-actions]

🔎 Lint report: bb/windows-hide-checkpoint-skills-git vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 11695 on HEAD, 11697 on base (✅ -2)

🆕 New issues (1):

Rule	Count
invalid-assignment	1

First entries

tests/run_agent/test_credits_notices_toggle.py:76: [invalid-assignment] invalid-assignment: Object of type `None` is not assignable to attribute `_credits_session_start_micros` of type `int`

✅ Fixed issues (2):

Rule	Count
unresolved-attribute	2

First entries

tests/run_agent/test_credits_notices_toggle.py:76: [unresolved-attribute] unresolved-attribute: Unresolved attribute `_credits_session_start_micros` on type `AIAgent`
run_agent.py:3040: [unresolved-attribute] unresolved-attribute: Object of type `Self@get_credits_spent_micros` has no attribute `_credits_session_start_micros`

Unchanged: 6139 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.